Error Message: The Account Is Not Authorized to Login from This Station

Article ID: 281648 - View products that this article applies to.
This article was previously published under Q281648
Notice
This article applies to Windows 2000. Support for Windows 2000 ends on July 13, 2010. The Windows 2000 End-of-Support Solution Center
(http://support.microsoft.com/?scid=http%3a%2f%2fsupport.microsoft.com%2fwin2000)
is a starting point for planning your migration strategy from Windows 2000. For more information see the Microsoft Support Lifecycle Policy
(http://support.microsoft.com/lifecycle/)
.
Expand all | Collapse all

SYMPTOMS

When you attempt to join a Windows 2000-based computer to a Microsoft Windows NT 4.0-based domain, you may receive the following error message:
The following error occurred attempting to join the domain "domainname": The account is not authorized to login from this station.
Back to the top | Give Feedback

CAUSE

This behavior can occur because the Local Group Policy, specifically those in the Computer Configuration\Windows Settings\Security Settings\Local Policies\Security Options folder have a restrictive setting.

Some of the policies that may cause this behavior are:
  • Digitally sign client communications (always)
  • Digitally sign server communications (always)
  • Digitally sign server communications (when possible)
  • LAN Manager Authentication Level set to Send LM and NTLM - use NTLMv2 session security if negotiated
  • Secure channel: Digitally encrypt or sign secure channel data (always)
  • Secure channel: Require strong (Windows 2000 or later) session key
Back to the top | Give Feedback

RESOLUTION

To work around this behavior, set the values back to what they would be if a clean install had occurred.

Examine the preceding policies and set them back to their default settings.

The default settings of these policies are:
  • Digitally sign client communications (always) - disabled
  • Digitally sign server communications (always)- disabled
  • Digitally sign server communications (when possible) - disabled
  • LAN Manager Authentication Level set to Send LM and NTLM - use NTLMv2 session security if negotiated - (default) send LM & NTLM responses
  • Secure channel: Digitally encrypt or sign secure channel data (always) - disabled
  • Secure channel: Require strong (Windows 2000 or later) session key - disabled
Restart your computer and you should be able to join the domain.
Back to the top | Give Feedback

STATUS

This behavior is by design.
Back to the top | Give Feedback

Properties

Article ID: 281648 - Last Review: March 1, 2007 - Revision: 3.5
APPLIES TO
  • Microsoft Windows 2000 Server SP1
  • Microsoft Windows 2000 Advanced Server SP1
  • Microsoft Windows 2000 Professional SP1
Keywords: 
kbenv kberrmsg kbprb KB281648
Back to the top | Give Feedback

Give Feedback

 
Back to the topBack to the top